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( TS//SI//NF) Introduction 

U.S. as World s Telecommunications Backbone 
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• Much of the world’s 
communications flow 
through the U.S. 

• A target’s phone call, e-mail 
or chat will take the 
cheapest path, not the 
physically most direct 
path - you can’t always 
predict the path. 

• Your target’s 
communications could 
easily be flowing into and 
through the U.S. 




International Internet Regional Bandwidth Capacity in 2011 

Source: Telegeograpliv Research 
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(TS//SI.//NF) FAA702 Operations 

Two Types of Collection 
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PRISM 

Collection directly from the servers of these U.S. 
Service Providers: Microsoft, Yahoo, Google 
Facebook, PalTalk, AOL, Skype, YouTube 
Apple. 
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(TS//SI//NF) FAA702 Operations 

ff 7 ?v .So//?: PRISM vs. Upstream 




PRISM 



Upstream 



DNI Selectors 

DNR Selectors 

Access to Stored 
C omnium c ations 
(Search) 

Real-Time Collection 
(Surveillance) 

“Abouts” Collection 
Voice Collection 

Direct Relationship with 
Comms Providers 



9 U.S. based sendee 
JT providers 

Coming soon 
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PRISM Collection Details 



Current Providers 



• Microsoft (Hotmail, etc.) 

• Google 

• Yahoo! 

• Facebook 

• PalTalk 

• YouTube 

• Skype 

• AOL 

• Apple 
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Wliat Will You Receive in Collection 
(Surveillance and Stored Comms)? 
It varies by provider. In general: 




• E-mail 

• Chat - video, voice 

• Videos 

• Photos 

• Stored data 
VoIP 

• File transfers 

• Video Conferencing 

• Notifications of target activity - logins, etc. 

• Online Social Networking details 

• Special Requests 



Complete list and details on PRISM web page: 

Go PRISMFAA 
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(TS//SI//NF) Dates When PRISM Collection 
Began For Each Provider 



Rata 





2007 2008 



2009 



2010 



2011 



2012 



2013 
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(TS//SI/NF) FAA702 Reporting Highlight 
PRISM. and STOKMBREW Combine 
To Thwart il 





SAME-DAY NTOC/FBI COLLABORATION 

PREVENTS 150GB EXFIL EVENT FROM C LEARED DEFENSE CONTRACTOR (CDC) 
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NTOC TIPS FBI 
MMINENT THREAT 

2 ) NTOC tips the 
FBI to the activity 






The victim performed co 
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(ts si nf) Some Higher Volume Domains 
Collected from FAA Passive 



. 8 



In addition to Hotmail, Yahoo, Google, Paltalk, Facebook, Skype, AOL: 
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PRISM Tasking Process 



Target Analyst inputs selectors into 
Unified Targeting Tool (UTT) 
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S2 FAA Adjudicators in Each Product Line 

Targeting Review/Validation 
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Special FISA Oversight and Processing 

(SV4) 

Stored Comms Review /Validation 



Surveillance 
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Targeting and Mission Management (S343) 

Final Targeting Review and Release 
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Unified Targeting Tool (UTT) 
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PRINTAURA; Site Selector 
Distribution Manager 



Surveillance 



Providers 


Targeting 
^ Selectors 


(Google, 
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Pending Stored Comms 



FBI 

Electronic Communications Surveillance Unit (ECSU) 
Research & Validate NO USPERs 



1 < Stored Comms Release 
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NUCLEON, 
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PRISM Collection Dataflow 




JO, Hotmail Gourde paltalkSm 

YAHOO: m aol 



You 



« 



AOL mail & 



w 


PRINTAURA. 


> 




S3532 


* 





MARINA 

& 

MAINWAY 



Protocol 
Exploitation. 

S3 132 JJ/ 



DNI Content. Videos. 




i FAA 
“Partitions 





TOP SECRET//SI //ORCON VNOFORN 










TOP SECRET//SI//ORCON//NO FORN 

GmJI 



facebook 



Hotmail 

msn 




JyCoogk 




GOOSlc paltalk.com You® 

_ jm (j CarrriLnciUO- BeyootfWaCK f 



€1 



AOL^mail A 



(TS//SI//NF) 



PRISM Case Notations 
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